CVE-2026-72592 dulldusk CVE debrief

Who should care

Administrators and users of dulldusk/phpfm version 1.8.0, as well as security teams monitoring for potential PHP code execution attacks, should be aware of this vulnerability and take immediate action to remediate it. They should review and apply vendor remediation, implement authentication and authorization for file uploads, and restrict file upload extensions to prevent PHP code execution. Additionally, they should consider compensating controls such as web application firewalls and monitor for suspicious activity.

Technical summary

The dulldusk/phpfm application through version 1.8.0 has an unrestricted file upload vulnerability, allowing an unauthenticated remote attacker to execute arbitrary PHP code on the server by uploading a PHP webshell and browsing to the uploaded path. The application ships with an empty upload extension filter and no authentication enabled by default, which facilitates the exploitation. The vulnerability can be mitigated by implementing authentication and authorization for file uploads, restricting file upload extensions, and monitoring for suspicious activity. Administrators and users of dulldusk/phpfm version 1.8.0 should review and apply vendor remediation, implement compensating controls, and monitor for suspicious activity.

Defensive priority

Immediate attention is required due to the critical CVSS score of 9.8 and the unrestricted file upload vulnerability allowing arbitrary PHP code execution.

Recommended defensive actions

• Review and apply vendor remediation for dulldusk/phpfm version 1.8.0
• Implement authentication and authorization for file uploads
• Restrict file upload extensions to prevent PHP code execution
• Monitor for suspicious file uploads and PHP code execution attempts
• Consider compensating controls such as web application firewalls

Evidence notes

The CVE record and NVD detail provide evidence of an unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0, allowing unauthenticated remote attackers to execute arbitrary PHP code. The application ships with an empty upload extension filter and no authentication enabled by default, which facilitates the exploitation. Defenders should verify the affected scope, review compensating controls, and monitor for suspicious file uploads and PHP code execution attempts.

Official resources